Summary On 02 January 2005, a Boeing 767-375 aircraft (registration C-FCAG, serial number24085) operating as Air Canada Flight092, was on a scheduled flight from Toronto/LesterB. Pearson International Airport, Ontario, to Santiago/Aeropuerto Comodoro Arturo Merino Benitez, Chile, with 144passengers and a crew of10. At 1102 Chile daylight time (CLDT), nine hours and 42minutes after take-off, the aircraft was in cruise flight at flight level (FL)370 approximately 180nautical miles (nm) north of Santiago, 60nm prior to the planned start of descent. At that time, the crew received an engine indicating and crew alerting system (EICAS) warning of low fuel pressure output from both boost pumps in the left main fuel tank, and 45seconds later the left engine (General Electric CF6-80C2B6 turbofan, serial number690255) flamed out. The crew immediately opened the fuel cross-feed valve, declared a Mayday with Santiago radar and began a drift-down descent. As the aircraft descended through FL330, the auxiliary power unit (APU) was started. At approximately FL230, 18minutes after the engine flamed out, the crew restarted the left engine. The aircraft continued to Santiago with both engines operating and landed without further incident at 1135CLDT. After landing, the fuel quantity indicating system indicated 4500kg in the right tank and 800kg in the left tank. After the engines were shut down, the fuel quantity in the tanks was "drip checked" using measuring sticks and found to be 4700kg in the right tank and no fuel in the left tank. The left hand fuel quantity indication later blanked out while the aircraft was on the ground in Santiago. Ce rapport est galement disponible en franais. Other Factual Information On 01 January 2005 at approximately 2100 eastern standard time, the aircraft arrived at the gate in Toronto from its previous flight.1 The crew entered 7600kg fuel remaining in the aircraft journey log; however, according to the aircraft communications addressing and reporting system (ACARS) arrival report, the aircraft arrived with 10100kg fuel on board. Flight dispatch planned the fuel load for the next flight based on all the applicable operational factors (including the arrival fuel) and prepared a Flight Release, which is a fuel message that is forwarded to the fueller. The aircraft fuel system comprises left and right main wing tanks with a nominal capacity of 18450kg (22975litres) each and a centre tank with a capacity of 36500kg (45450litres) for a total of 73400 kg. Fuel is normally loaded equally in the main wing tanks. If more fuel is required for a flight, it is loaded into the centre tank. The fuel quantity indicating system (FQIS) comprises sensors and a densitometer in each fuel tank, a fuel quantity processor unit (FQPU) that calculates the fuel in each tank, an overhead panel in the cockpit that displays individual tank and total fuel quantity,2 and a quantity display at the fuelling control panel in the leading edge of the left wing. The FQIS also controls the fuelling valves to terminate fuelling automatically at the level selected by the fueller. The fueller found the fuel system indicating 3700kg in the left main tank, 5900kg in the right main tank, and zero in the centre tank for a total of 9600kg of fuel on board. The main wing tanks were filled until they shut off automatically, then the centre tank was filled to achieve the desired total quantity. The fueller's handwritten entries on the Flight Release slip showed that 61354litres/49721kg3 of JetA1 fuel were added, which would have brought the total fuel to 59321kg, provided there was 9600 kg of fuel on board at the start of fuelling. On completion of fuelling, the Flight Release slip indicated 18800kg in the left main tank, 23670kg in the centre tank, and 18800kg in the right main tank for a total of 61270kg. The crew for the flight to Santiago noted a discrepancy between the indication on the fuel totalizer (9600kg) and the amount entered by the previous crew in the journey log (7600kg). When the crew entered the fuel upload into ACARS with 7600kg from the previous flight, the ACARS unit indicated insufficient fuel for the flight. Air Canada procedures require the captain of the aircraft to resolve such a discrepancy before departure, but do not indicate a specific procedure for doing so. The crew manually changed the amount of the arrival fuel to 9600kg, which coincided with the amount that the fueller had noted as the start fuel, and ACARS then accepted the upload. Neither the operational flight plan nor the Flight Release slip indicated the arrival fuel from the previous flight. It was not clear how flight dispatch used arrival fuel in planning for the next flight, but had the information been available to the fueller or the flight crew, it would have indicated another discrepancy in the fuel load. A further indication of fuel discrepancy was that the crew found the rudder trim set at three units left at the end of the previous flight (it is usually less than one unit from neutral), indicating that the aircraft was trimmed left-wing down,4 consistent with less fuel in the left main wing tank. After refuelling, the FQIS cockpit indications were recorded as 18500kg in the left main tank, 24500kg in the centre tank, and 18500kg in the right main tank for a total of 61500kg, and the flight management computer (FMC) indicated a total of 61500kg. The operational flight plan showed the required fuel to be 61300kg. The aircraft departed Toronto on 01January2005 at 2320. Fuel remaining at a waypoint 56minutes after take-off was recorded as 53700kg, 2700kg more than the minimum fuel shown in the operational flight plan. The flight proceeded with no significant deviations from the flight planned route and conditions. Two minutes before the engine flamed out, the flight log indicated 11300kg fuel remaining, 4200kg more than the minimum required, indicating that fuel consumption had been less than expected during cruise flight. The crew noted that the left main tank fuel quantity blanked out intermittently during the flight. The flight data recorder (FDR), which records total fuel quantity from the FQIS, showed zero for most of the flight, indicating a failure in the FQIS. When a quantity was recorded, unexplained fluctuations of over 1000kg suggest that the indication was not reliable. The crew, therefore, relied on the fuel quantity indicated by the FMC, which calculates the fuel remaining by subtracting the fuel consumed by the engines5 from the initial total amount at engine start. When the engine flamed out, the FQIS cockpit display showed 5700kg fuel in the right main tank, and the left main tank indicator was blanked out. The FMC calculated total fuel remaining was 10900kg; by deduction the left main tank should have contained 5200kg. After landing, the actual fuel remaining (4700kg) was 5000kg less than the FMC calculated fuel remaining. That amount is consistent with calculations based on engine fuel flow from the FDR. Fuel consumption during the flight was less than indicated in the operational flight plan, but was consistent with the aircraft being lighter than planned throughout the flight. In the absence of any indication of a fuel leak, it was deduced that the fuel state of the aircraft must have been 5000kg less than was indicated after fuelling. The aircraft's history of fuel indication problems during the five weeks prior to the occurrence is presented in AppendixA. There were five defect reports stating that the left fuel quantity indication went blank or was inoperative. In each case the snag was deferred and the aircraft released for operation under provisions of the minimum equipment list6 (MEL) 28-41-01-A, which, among other things, requires the fuel quantity to be verified by measuring sticks before each departure. Maintenance action on the first three entries involved increased troubleshooting of system wiring and components, and on two occasions the densitometer in the left tank was replaced. On completion of rectification of the third indication snag on 21December, the densitometer was unserviceable and the aircraft was released under MEL 28-41-01-C1. On the fourth occasion, the left fuel quantity defect was signed off as fixed without any maintenance work being done after the system performed normally on two subsequent flights. On the fifth occasion, six days before this occurrence, the snag appeared and was deferred in Sao Paulo, but the aircraft defect log was not filled in correctly. When the aircraft returned to Toronto, a technician, apparently unaware that a MEL limitation was attached to it, incorrectly signed it out and entered it in the aircraft maintenance tracking and control (AMTAC) system as fixed, resulting in the MEL being removed from the deviation list. As a result, not only was the snag not repaired, but the aircraft was not subject to the MEL 28-41-01-A with respect to verifying fuel quantity with measuring sticks prior to each flight and with respect to operational procedures for monitoring fuel and detecting fuel leaks. During this period, while operating in accordance with the MEL, there were two "information" defect entries that noted erratic or erroneous left fuel quantity indications (over-reading by as much as 2500kg) and one entry that noted a normal left fuel quantity indication for one flight. There was also a verbal report of the left fuel indication under-reading. CARs Standards for Air Operator Maintenance (AOM) require a defect recording and control system that identifies recurring defects and specifies how the defects should be handled. CARs Standard 726.05, Defect Recording and Control (1) The defect recording system shall include a method to highlight defects that recur, so that they are readily identifiable by flight crews and the maintenance organization at all bases where the aircraft is operated. The air operator is responsible for identifying defects as recurring defects to maintenance personnel in order to avoid the duplication of unsuccessful attempts at rectification. (2) The defect control system shall ensure that the rectification of a defect identified as a recurring defect will take into account the methodology used in previous repair attempts. (3) For the purposes of these standards, defects are recurring defects where a failure mode is repeated three times, on a particular aircraft, within 15 flight segments of a previous repair made in respect of that failure mode. In addition to describing the handling of recurring defects, there is a technical dispatch procedure in the standards, as follows: CARs Standard 726.06, Technical Dispatch Procedures (only the applicable paragraph is quoted). (1) The purpose of the technical dispatch procedures is to ensure that only those aircraft that conform to applicable airworthiness, operational, and corporate requirements are dispatched into service. This system also forms the basis upon which the pilot-in-command will determine aircraft serviceability in respect of airworthiness directives, maintenance, weight and balance control, operational, or corporate requirements. After the indication problem was rectified on 21December, and the aircraft placed under the provisions of MEL 28-41-01-C1 for the densitometer, the maintenance control and dispatch of this aircraft did not effectively identify and control subsequent fuel indication problems as a continuation of the earlier problem, resulting in the dispatch of this aircraft when it was not airworthy in accordance with CARs. Other discrepancies were noted in the maintenance and dispatch of the aircraft during that period. On 02 and 03December2004, the aircraft was dispatched on two flights under both MEL 28-41-01-A and MEL 28-44-01, contrary to the qualifying condition in MEL 28-44-01 that the measuring sticks not be required for operation under MEL 28-41-01. On 11December, the aircraft was dispatched under MEL 28-41-01-A, one day outside the repair interval stipulated in that MEL. On 15December, the aircraft was dispatched with a disconnected densitometer without being placed under the provisions of MEL 28-41-01-C1. On 30December, MEL 28-41-01-C1 was extended despite aircraft downtime being scheduled and parts being available. On 02January2005, a densitometer defect was signed off as fixed when it was not, resulting in the provisions of MEL 28-41-01-C1 being lifted when they still should have applied. Each of these contravenes the requirements of CAR605.09 and indicates deficiencies in Air Canada's maintenance control and technical dispatch system. An Air Canada Maintenance review of the process identified several problems including complacency, circumvention of procedures, manpower shortage, unclear roles and responsibilities, and acceptance of the situation as being the norm. Action was initiated to redress these problems. Another factor concerning operations with inoperative FQIS indications and under the auspices of MEL 28-41-01-A is that the centre tank fuel pump configuration on the Boeing767, when changed in compliance with airworthiness directive 2001-15-08 (which applied to this aircraft) and Boeing Service Bulletin 767-28-0062 (revised 05February2004), is prone to initiating a fuel imbalance. Until final resolution of the issue, Boeing issued revised Operations Manual Bulletin ACN-53R2 dated 12July2004 to Air Canada recommending, among other things, not dispatching an aircraft under MMEL 28-41-1 with an FQIS quantity indicator inoperative if the centre fuel tank is loaded. It further recommends that if a main fuel tank FQIS quantity indicator fails after dispatch, the flight be terminated by taxiing back to parking or landing at the nearest suitable airport. At the time of this occurrence, an earlier version of the Boeing Operations Manual Bulletin, which did not contain these procedures, was incorporated in the AOM, and the Air Canada MEL 28-41-1A did not preclude operation with fuel in the centre tank. As a result, during the month prior to this incident, the aircraft was operated under the provision of MEL 28-41-1A with fuel in the centre tank. In addition, when the left main fuel tank indicator failed on the incident flight, it did not land at the nearest suitable airport as recommended by the Boeing Operations Manual Bulletin. After the flame-out, a defect report was again entered for the left fuel quantity indication being blank, and the aircraft was dispatched under MEL 28-41-01-A until it could be repaired in Toronto. After considerable troubleshooting, the final rectification was replacement of a wiring harness in the left wing. The defect accounts for both the faulty FQIS readings and the premature automatic shut-off of the refuelling of the left main tank. The fuel shortage would have been detected had the quantity been verified using measuring sticks in accordance with MEL 28-41-01A. Since this was not done, the aircraft took off with a fuel imbalance of 5000kg and landed at Santiago with an imbalance of 4700kg, exceeding the limitations contained in the AOM.7 CAR602.07 requires that aircraft be operated in accordance with the operating limitations set out in the aircraft flight manual. The total fuel load at take-off was approximately 56500kg, 4800kg less than required by the operational flight plan and company policy; however, the flight arrived at destination with adequate fuel to proceed to the flight-planned alternate. MEL 28-41-01A contains operational procedures for monitoring fuel quantity and for detecting fuel leaks in the event that a portion of the FQIS system is inoperative. It notes that a fuel imbalance condition may not be signalled by FUEL CONFIG advisory messages when the left or right FQIS is inoperative. It also notes that flame-out of an engine is an indication of a possible fuel leak. The Boeing767 Quick Reference Handbook (QRH) does not include engine flame-out as a symptom of a fuel leak. The crew did not consider the possibility of a fuel leak because they had not seen any EICAS messages or other indicators of a fuel leak as presented in the QRH. They were unaware that the EICAS messages were inhibited due to the failure of the left FQIS. In the event of a FQIS failure, the Boeing767 has no independent physical means of detecting low fuel quantity before fuel exhaustion occurs. The crew must depend on the FMC to calculate the fuel remaining based on the assumption that the initial value was correct. In the event of a fuel indicating system malfunction, the QRH contains no additional guidance or cautionary procedure, similar to that in MEL 28-41-01-A, for detecting a possible fuel leak. One of the first steps in the QRH procedure for a suspected fuel leak is to turn the cross-feed off. In this incident, the fuel leak procedure was not carried out, the cross-feed was turned on immediately after the engine failed, and the engine was restarted, incurring the risk of feeding a leak and depleting the fuel on the good side. The following Engineering Branch report was prepared: This report is available from the Transportation Safety Board of Canada upon request.